CN1792060B - Methd and system for authenticating physical object - Google Patents

Abstract

A system for authenticating a physical object includes an enrolment device, an authentication device, and a storage for storing authentication data. The enrolment device includes an input for receiving a property set Y of the object measured using a measurement procedure. A processor is used for creating a property set I from the measured property set Y that meet a predetermined robustness criterion. It then creating a property setA from the property set I that includes less information on the actual properties than property set Y, and finally generates a control value Vin dependence on properties of the property set A. An output is used for supplying the control value to the storage as part of the authentication data. The enrolment device operates in an analogous way.

Description

Be used to authenticate the method and system of physical object

The present invention relates to a kind of method for physical object generation verify data, and a kind of method that physical object is authenticated.In addition, the present invention relates to a kind of Verification System.

The physical object authentication can be used to many application, such as access security building or access digital data (for example being stored in computer or the movable storage medium) conditionally conditionally, or be used for identifying purpose (for example being used for collecting the expense of specific activities) to the people who is identified.The biometrics authentication is well-known.In this system, use a kind of suitable reader, such as fingerprint scanner or iris scanner, read a people's (physical object) biometrics attribute.These attributes and reference data compare.If coupling, this people just is identified maybe can be allowed visit.Reference data about this user has been acquired and has been stored safely as far back as registration phase, for example is stored in a safety database or the smart card.

It also can not be human wanting authentic physical object.For example, this object can be a kind of storage medium that contains protected digit content as CD, DVD, solid-state memory.As a kind of measure that prevents unauthorized reproduction and/or copy, described content itself can be stored with a kind of form of encryption.A kind of believable storage medium typically comprises measurable attribute, and it makes that promptly reproduction/copying equipment can obtain required decruption key preferably in such a way, and unauthorized reproducing device then can not obtain these keys.Typically these attributes are not stored as routine data, because this will make the man-to-man illegal copies of making protected content and attribute become possibility.This copy thereby can not distinguish with original contents and be considered to believable.On the contrary, these attributes are hidden in the medium itself at least in part, rather than with its as storage on storage medium.These attributes are that the variation as the physical parameter of storage medium obtains from storage medium.For CD, a kind of way is by using a kind of so-called " wobble tracks (Wobble) ".Different media will have a different wobble tracks or not have wobble tracks at all, so authentication result will can not produce to the required decruption key of contents decryption.With reference to the same assignee's of the present invention United States Patent (USP) 5,724,327 (attorney docket PHN 13922), this patent has been described this " wobble tracks " and the various technology of stored information therein created.Wobble tracks is an example of the function (PUF) that physically can not clone.

Typically, authentication protocol converts these attributes to a shielded controlling value by cryptography method.The controlling value that generates and a kind of reference control value of storage compare.For example, reference data is stored on the central server, and this server can be in the office space of having only the member to visit, bank or club, or maybe needs many other places of being identified in user's visit of can having ready conditions.Because biometrics is human unique identifier, privacy concern may occur.People are for seeming biometric information that safe database provides them and feel uneasy to many.Practice shows that biometric information can become by unsafe realization (for example being broken through by the hacker) or the abuse by the Systems Operator can be for utilization.In enrollment process, not protected biometric data can be for utilizing especially.If this information all can be for utilizing in many places, the possibility of abuse will increase.Should remember that also biometric data is that the good user identity of a kind of usefulness is represented.Some of " theft " people or most of biometric data (may be by only breaking through a kind of implementation) can be regarded as stealing the electronics equivalents of a people's identity.The data of theft may make to obtain and be subjected to the visit of system of biometric data protection relatively easy to many other.Thereby, use " identity theft " of biometric information to have more serious consequence than the theft of " simply " credit card.It is relatively easy to cancel a credit card, but the biometrics identity of cancelling a people wants complicated many.Using another problem of biometric information (particularly retina scanning) is that it can expose disease pattern, thereby is very easily abused.In these problems some are also relevant with the authentication of the physical object that is not based on biometric data.For example, people have one can be by reading the identity card that card image is verified automatically.If this card is very successful and be used to many application, this card cancel the trouble that will become.

Many authentication protocols use a kind of one-way function, such as hash (hash), this function reduced need be in reference control value data quantity stored.Conventional one-way function is very responsive for the medium and small disturbance of input.Therefore, when the input data had noise, those cryptographic primitives can not directly be used.When the input data are when obtaining such as the measurement of physical objecies such as biometrics, PUF, this typical just situation.

WO 02/078249 has described a kind of authentication method, and this method is that n-ties up the vectorial enterprising row operation in the Euclidean space at the attribute of measuring directly.Some unspecified features have been extracted, such as X ₁... X _s∈ R, and estimated each feature X _i, i=1 ..., the average μ of s _iAnd variances sigma _i ²In addition, selected a real number r ∈ (0,1) and formed code book B={ (w ₁..., w _s): w _i=r σ _ik _iI=1 ..., s; k _i∈ Z}.At next step, selected a random vector δ=(δ ₁..., δ _s), make c=(c ₁..., c _s), c _i=μ _i-δ _iIt is an effective code word among the password B.At last, hash form h (c) and the δ of c are stored.Authentication comprises selects code word c ': a c '=argmin _c∈ _B|| x '-δ-c|| and the hash form h of c ' (c ') compared with storing value h (c).In other words, input feature vector Xi is shifted random number δ _IThe position, and should be worth with step-length r σ _iBe quantized from the nearest point of grid.In this method, offset delta and code word c ₀The hash form can obtain (perhaps, if database is revealed, they just become available) publicly.Assailant's hash function that can reverse in principle can be supposed, and code word c can be obtained ₀, thereby given the assailant to identity x ₀Visit.In addition, this scheme is insecure.The probability of characteristic vector that correctly authenticates s-measured on the user of honesty dimension is less than 2 ^-s, this is too low for the practical application amount.

A target of the present invention provides a kind of improved method and system that is used to authenticate based on the physical object attribute.

In order to realize described purpose of the present invention, the method that a kind of generation is used for verify data that physical object is authenticated comprises:

Use a kind of property set Y of measuring process measuring object;

Create property set I according to the property set Y that measures, this property set I satisfies a kind of predetermined robust standards;

Create property set A according to property set I, this property set A comprises still less the information about actual attribute than property set Y;

Attribute according to property set A generates a controlling value V and this controlling value is inserted verify data.

The method according to this invention acts directly on the measured attribute, rather than these best property of attribute mapping are arrived password value.Utilizing before cryptography method handles, the attribute of these measurements must be quantized into centrifugal pump.Contain noise owing to measure attribute kit, quantized result may be different in different experiments.Especially, if the value of a physical parameter near a quantization threshold, the trace noise all may change the result.After the data that quantized are applied an encryption function, trickle variation will be exaggerated and the result will not have any similarity with expected result.This fundamentally is an essential attribute of encryption function.In order to reduce risk, at first create the attribute of one group of robust from measuring collection at the enterprising line operate of unreliable attribute.The collection of described robust comprises that those have the attribute of high s/n ratio.Then to reduce the amount of information in the property set of robust.The property set of this simplification has constituted the basis of the controlling value that is used to authenticate.Crack this controlling value and will only expose one group of information of simplifying.The property set of robust will still comprise still unexposed information.These unexposed information can be used to other authentication application, even these are used also based on those data that have been exposed.

According to the method for dependent claims 2, carry out a kind of contracted transformation.This contracted transformation converts predetermined input value to corresponding output valve.It also will convert identical corresponding output valve to quite similar any input value in the predetermined input value.On the other hand, visibly different input value is converted into different output valves.An example of this contracted transformation is Δ-contracting function, and this function has first input (cryptography data), and second imports (auxiliary data) and generated output based on first and second inputs.Second the input be a kind of controlling value, this value defined be used for the value of first input signal scope (for example use a kind of preset distance measure in case the target input value within preset distance) and with the corresponding output valve of each first input value scope.Contracted transformation has further increased robustness, because an attribute of physical object always is converted into identical output valve, as long as this attribute only is subjected to limited noise effect so that it still is within the identical input value scope.In addition, it has reduced amount of information.It is impossible directly judging input from output.

Described as the method in dependent claims 3, contracted transformation has the binary number that the attribute transformation that surpasses two probable values (typically being 8 bit values at least) becomes the symbol of this attribute of expression with one.This symbol can be plus or minus.On the occasion of representing that negative value can be represented with numeral " 1 ", or vice versa with digital " 0 ".The null value attribute should not appear at concentrating of robust usually.

Described as the method in dependent claims 4, the step of creating property set A comprises a subclass selecting property set I.Selecting subclass also is to reduce a kind of effective ways of amount of information.Described as the method in dependent claims 5, preferably, subclass selects to be subjected to auxiliary data W to instruct.For example, auxiliary data can be specified and be used which attribute and do not use which attribute.Auxiliary data W is inserted into verify data and uses in the verification process of reality.Preferably, auxiliary data W is unique for an authentication application.Use a different selection course by using for each, cracking the subclass that is used for an application can not influence other application (being like this when not being exposed for abundant data at least).

Described as the method in the dependent claims 7, a kind of robust standards of predetermined signal to noise ratio based on tested attribute is used in the establishment of the attribute of robust.The step of creating property set I is included in property set Y and goes up the property set I that a kind of conversion Γ of execution creates separation ₁And I ₂, I here ₁The signal to noise ratio of attribute compare I ₂The signal to noise ratio of attribute want high; And use I ₁As property set I.Described standard may be based on the statistical attribute of measuring process, thereby can extract on statistics attribute reliably.Described standard can also constantly be revised up to property set I ₁The attribute that comprises desired amt.

Preferably, conversion Γ is a kind of linear transformation, and it converts the vector of a representation attribute collection Y to vector that I is gathered in an expression, and its component is α _i, each component of a vector α here _IFor other component of a vector α _j(j ≠ i) is independently, and wherein component of a vector is to arrange according to the signal to noise ratio of estimating.This is a kind of effective ways of attribute of the independent robust that obtains desired amt.Suitable conversion can be differentiated conversion based on principal component analysis or Fisher.

As described in the method for dependent claims 10, the statistical attribute that can be used to conversion comprises a covariance matrix and a corresponding Distribution Statistics F who derives from the estimation attribute X of object.

As described in the method for dependent claims 11, the absolute value of being created is used to gather I greater than the attribute of thresholding ₁Other attribute does not re-use.Described thresholding is that the noise level from tested property set is derived.

As described in the method for dependent claims 12,, then, attribute just can create controlling value V by being carried out encryption function since created a robust and property set that simplified.By not exposing property set itself only is that its cryptography is represented, the detection of information is difficulty more.Preferably, described encryption function is an one-way function, such as a uni-directional hash.

These and others of the present invention will become fairly obvious, and will set forth in conjunction with the embodiment that hereinafter describes.

In the accompanying drawings:

Fig. 1 has shown a block diagram according to Verification System of the present invention; And

Fig. 2 has shown the main treatment step in the preferred embodiment.

Fig. 1 has shown a block diagram according to the system 100 of this invention. Described system comprises a calling mechanism 110, and this calling mechanism 110 generates verify data and it is stored in the memory 130. For this reason, described calling mechanism comprises an input 112 that be used for to receive the attribute that measures from physical object 105. Described attribute is to use suitable measurement mechanism 120 measured, and this measurement mechanism 120 can be integrated into calling mechanism. Physical object can be the individual. What show among the figure is the fingerprint 105 of measuring from the person. Also can measure other biometric data, such as the scanning iris. These technology itself are well-known and will no longer illustrate. Described object also can not be human. For example, this object can be an electronic identification card. Specifically, this object can be a data medium, such as a kind of digital audio/video content vector (for example CD). In this case, object 105 can with memory 130 combinations, namely this object also carries verify data. If should be to liking a storage medium object, described attribute can be the mutation of a physical parameter of storage medium. These mutation can be to have a mind to produce, and are specific to each object, perhaps can be at random. As long as mutation is enough unique for object, just can be used to authentication. What no matter be physical object, all suppose for this physical object to measure many attributes. In principle, described attribute is " simulation ", and each attribute is quantized into the value of many bits. Typically, use the property value of 8 bits to I haven't seen you for ages. Described calling mechanism comprises a processor 114 that is used for generating verify data. This processor can make any suitable processor, such as the used processor of PC for example. Typically, used general processor is to work under the control of suitable program. This program can be stored in the nonvolatile storage. Because calling mechanism preferably will create the verify data that is difficult for being cracked, so preferably should take some security steps. For example, calling mechanism can be placed in the security context or the section processes step can be performed in security module, in a kind of anti-cryptography module of stealing secret information. Described verify data is stored in the memory 130 by exporting 116.

Described system also comprises at least one authenticate device 140. In principle, can finish authentication with the same equipment that is used for registration. In this case, calling mechanism and authenticate device are same. In description, suppose that two devices are independently with the difference between clarification registration and the authentication. Calling mechanism comprises an input 142 that be used for to receive the attribute that measures from physical object 105. Described attribute is to use suitable measurement mechanism 170 to measure, and this measurement mechanism 170 can be integrated into authenticate device. Preferably, measurement mechanism 120 and 170 has similar design. What measure is same physical object, and this physical object has created verify data by authenticate device 110. Described authenticate device comprises a processor 144 that is used for comparison other attribute and verify data. This processor can be any suitable processor, such as the used processor of PC. Typically, used general processor is to work under suitable programme-control. This program can be stored in the nonvolatile memory. The input of authenticate device also is used to receive verify data from memory 130. Should recognize, calling mechanism, memory and authenticate device can be physically far apart. If so, can exchange verify data with suitable means of communication. Memory 130 can also be integrated in the calling mechanism.

In description, the term authentication is used with a kind of implication of broadness. Described technology can be used to checking: this physical object is believable, and is namely genuine, but also can be used to set up this object or any other suitable people's identity. The result of described method and system is a controlling value. This controlling value can be used to any purpose. For example, if coupling occurs during authenticating, this can trigger an action, as allowing a people enter the entrance of a building or a computer. Similarly, the stored data corresponding with controlling value of can packing into. For example, this can be any type of sign, and as a people's name, but this can be an identification number equally. Even can extract an account No., thereby allow the access of authentic user to the account. All these mutation do not exceed professional's professional skill, and will be not described in detail. This explanation will concentrate on uses biometric personnel to authenticate (comprising identification). Should recognize that same technology also can be used to many other purposes, they will authenticate the attribute that measures from physical object jointly.

Three demands below the agreement that physical object is authenticated according to the present invention is designed to satisfy:

(i) to the robustness of noise

In essence, owing to relate to biostatistics or physical measurement, measurement can be subjected to the infringement of noise. It is robust that certificate scheme is designed to little noise, if namely represent system with measuring X+ ∈, here X is the template of "True", ∈ measures noise, system should be able to provide answer when whether X+ ∈ belongs to the request of a people or an object definitely to measuring so, and this people or object claim that oneself is. This demand will be shunk institute by the term noise and be referred to.

(ii) safety

Different security considerations is arranged in the exploitation of authentication protocol. At first, in the situation of assailant's access less than template, he will palm off the another one people must be very difficult. Secondly, the assailant must derive about template or secret any information from the information that server obtains. Below, this certificate scheme is known as and zero is exposed, if the assailant can not extract any information about secret from the information that he receives, or the E-exposure of being known as, be negligible words if the information that the assailant obtains is compared with the information that he must guess. The 3rd, must consider the protection of anti-" eavesdropping ", namely carry the possibility that the secret communication channel victim of coding is seen. Can use the standard method of similar " zero knowledge " agreement to eliminate the third threat, will no longer describe in detail here.

(iii) privacy

The meaning of privacy is, even in the situation that the safety database of storage controlling value is captured, and in the secret victim of " Alice " (its identity is stored in controlling value that people in the representing) situation about grasping, this assailant can be the Alice in this application-specific with oneself authentication in principle, but he can not be the Alice in the application of the identical biometric template of other any dependence with oneself authentication. In other words, by shooting this database, the assailant will recognize a certain secrets using its biometric template to generate for Alice, but he can not recognize template itself. Therefore, he can not produce other secret of the template generation of using Alice. But the more important thing is that the sensitive information that can derive as there is specific disease in retina scanning, can not expose from template.

Registration by the calling mechanism execution:

In this stage, people or physical object must be accessed and for example be positioned at " authentication center " calling mechanism (CA). This object/people's attribute is measured, process and be used as reference data V storage, and in order to using with any auxiliary data in the back, these auxiliary datas may be used to instruct this processing. Preferably, auxiliary data is determined by the attribute of X. In on-line Application, these data can be stored in central database or these data can and be provided for the ISP by the digital signature of CA proof.

In brief, carry out following step according to calling mechanism of the present invention:

(1) obtain measurement, provide property set Y,

(2) dependency collection Y creates the robust attribute, provides the attribute I of one group of robust,

(3) information among the reduction property set I provides property set A,

(4) generate controlling value V based on property set A,

(5) storage V and any auxiliary data W that is used to instruct processing.

Just as will be described hereinafter, step 2 and 3 can be regarded as a signal processing function G and operate on property set Y, under the control of auxiliary data W, provide output G (Y, W).This has formed property set A.Signal processing can be shown as step 2 and 3 independently sequential processes step (illustrating among two embodiment hereinafter), but also can be performed (showing among an embodiment hereinafter) in the treatment step of an integral body.Auxiliary data W is guiding step 2 and 3 simultaneously.For authentication, typically step 2 and 3 can be performed in an operation, because W is known.

Controlling value can be property set A simply.In order to protect the communication line between calling mechanism, memory and the authenticate device, in a preferred embodiment, create on the attribute that controlling value V is included in property set A and carry out an encryption function.Preferably, this encryption function is the one-way function of a homomorphism.Suitable hash function function that comes to this.

For the r ∈ Z that selects at random _nWith g be the maker (Paillier encryption function) of a son group, r| → r ²Mod n, m| → g ^M+nrMod n ²The secret encryption of deriving from biometric measurement then is stored in database.The one-way function of these homomorphisms allows to set up a kind of agreement of zero knowledge, is used to check the knowledge of template and can expose any information.Preferably, owing to the communication in the zero-knowledge protocol process changes with each session, so this communication line can obtain better protection.

Authentication by the authenticate device execution:

This authentication protocol comprises a kind of measuring equipment, and this equipment extracts the analogue measurement data Y from physical object.These analogue datas then by a signal processing function G (Y, W) processed, utilize auxiliary data W, and at last by being protected to its one-way hash function h that uses an anticollision.Suitably choice function G is very important.More accurately, the step below this agreement is carried out:

(1) obtain V and any auxiliary data W that is used to instruct processing,

(2) obtain measurement, provide property set Y,

(3) dependency collection Y creates the attribute of robust, provides the attribute I of one group of robust,

(4) information among the reduction property set I provides property set A,

(5) generate controlling value V ' based on property set A,

(6) V ' and V are compared: if coupling, this object is just certified.

Attention: the auxiliary data (if there is) is used to instruct in similar mode in a kind of and the enrollment process and handles.For authentication, typically step 2 and 3 can be performed in an operation, because know that from enrollment process which attribute is robust (being described by auxiliary data W), therefore in many examples, might be only on the attribute of selecting execution in step 4 and need not create a less set clearly.

Measure

The property set Y of the physical object that a kind of suitable measuring process is used to obtain certified (or registration), this collection certain actual corresponding attribute (such as biometrics) X=(X with this object ₁..., X _n) measured value Y=(Y ₁..., Y _n) ∈ R ⁿBe expressed as a n-dimensional vector.Always introduce noise because measure, measured value vector Y=(Y ₁..., Y _n) comprise a real signal X=(X ₁..., X _n) and a pollution noise E=(E ₁..., E _n).In specification, will use these vectors.Should recognize that any multidimensional numeral (measured value) array can easily be converted to vector (for example by row being connected into a vector).As hereinafter in further detail as described in, in a preferred embodiment, on a vector with less component, created a controlling value.In order to make this controlling value have rational fail safe, it is many normally as the bits of password to require this subclass to comprise, such as 56 bits that are used for DES or be used for 128 bits of AES.In this preferred embodiment, Y should comprise more component, for example more than the twice.The length of Y can depend on the amount of information (for example more noise means the more measured value of needs) that exists in noise level and the measured value.

As will be hereinafter described, the signal processing of two preferred embodiments be based on the statistical attribute of signal X and/or noise E.These statistical attributes can be estimated with any suitable method, for example by taking multiple measurements and then use the well-known suitable statistical estimation method of a kind of those skilled in the art to estimate described statistical attribute between record time.

Create the attribute of one group of robust

Create a property set I from the property set that measures, this property set I satisfies a kind of predetermined robust standards.Preferably, Yu Ding robust standards is based on the signal to noise ratio of the attribute that measures.Property set Y is used to create the property set I of two separation ₁And I ₂, I here ₁The signal to noise ratio of attribute be estimated as and compare I ₂The signal to noise ratio of attribute want high.So I ₁Be used as property set I.Hereinafter, will three alternatives that are used to create the property set of robust be described.Provide robustness to need not to use error correcting code according to embodiments of the invention for the measurement mistake.

First embodiment

Be set I ₁The attribute of robust selected set Y those have the attribute of enough big absolute value.Enough mean X greatly _iFor Y _iContribution be greater than E _iContribution, so signal to noise ratio (S/N) is at least 1.Measure by carrying out several times, can obtain the statistical estimate preferably of noise level Ei at enrollment process.Preferably, have only those to surpass the Y of this estimated value (for example S/N＞3) significantly _iAttribute be as robust and be used, promptly be given to the set I ₁If the noise level of measuring process is known, just do not need to carry out repeatedly to measure to obtain this estimation.

The second and the 3rd embodiment

In these two embodiment, by on property set Y, carrying out the property set I that a kind of conversion Γ creates two separation ₁And I ₂Create property set I, here I ₁The signal to noise ratio of attribute be estimated as and compare I ₂The signal to noise ratio of attribute want high.Described conversion Γ depends on the statistical attribute of measuring process.Preferably, statistical attribute comprises a covariance matrix and a corresponding Distribution Statistics F who derives from the estimation attribute X of this object.Advantageously, described conversion Γ is a kind of linear transformation, and this conversion converts the vector of a representation attribute collection Y to vector that I is gathered in an expression, and the component in this vector is α _i, each component of a vector α here _iWith other component of a vector α _j(j ≠ i) is independently, and wherein each component of a vector is classified according to the signal to noise ratio of estimating.Preferably, give set I ₁(or I ₂) thresholding of specified attribute is to derive from the noise level of measuring property set Y.Based on mentioned above principle, will be described conversion Γ at two embodiment (the second and the 3rd embodiment).First embodiment uses principal component analysis; Second embodiment uses the Fisher conversion.

Second embodiment-principal component analysis.

Suppose n-dimensional vector X=(X ₁..., X _n) have a distribution F.Make that ∑ is corresponding covariance matrix $\mathrm{\Σ}={\left({\mathrm{\σ}}_{\mathrm{ij}}\right)}_{i,j=1}^n,$

Here σ _Ij=E (X _iX _j)-E (X _i) E (X _j) (E is a desired value in this formula).

Γ is the quadrature unit matrix, comprises the eigenvector of ∑, promptly

Γ * ∑ Γ=Λ=diag (λ ₁..., λ _n), be without loss of generality here and can suppose λ ₁〉=... 〉=λ _n〉=0.

The i row of Γ, γ _iBe the eigenvector of ∑, corresponding eigenvalue is λ _iMake that m=E (X) is the average of X, each X can be expressed as X=m+ Γ α so

Here α=(α ₁..., α _n) be a vector, its α _i=＜X-m, γ _i＞α _iI the principal component that is called as X.Therefore, for a random vector X, made up a new random vector α.Have the situation of Gaussian Profile for X, promptly X～N (m, ∑) can provide the distribution of α.So, following formula is set up

(a)E(α ₁)＝0；

$\left(b\right)E\left({\mathrm{\α}}_1^2\right)={\mathrm{\λ}}_i;$

(c)cov(α _i，α _j)＝E(α _iα _j)＝0?for?i≠j；

$\left(d\right)\mathrm{Tr}\left(\mathrm{\Σ}\right)={\mathrm{\Σ}}_{i=1}^n{\mathrm{\λ}}_i,\det \left(\mathrm{\Σ}\right)={\∏}_{i=1}^n{\mathrm{\λ}}_i.$

Use a well known fact: incoherent Gaussian random variable also is independently, can draw α ₁..., α _nBe conclusion independently, and α _i～N (0, λ _i).

The 3rd embodiment-Fisher differentiates conversion

Suppose that X has distribution F, its average is m, and covariance matrix is a ∑ _F, and E has distribution G, and its average is 0, and covariance matrix is a ∑ _G, this matrix is assumed that positive definite.Make that Γ is a matrix, by ∑ _G ^-1∑ _FEigenvector constitute, promptly ${\mathrm{\Σ}}_G^{-1}{\mathrm{\Σ}}_F\mathrm{\Γ}=\mathrm{\Λ\Γ}=\mathrm{diag}({\mathrm{\λ}}_1,...,{\mathrm{\λ}}_n)\mathrm{\Γ}.$ ∑ _G ^-1∑ _FEigenvalue and ∑ _G ^-1/2∑ _F∑ _G ^-1/2Eigenvalue equate.Therefore, for all i=1 ..., n has λ _i〉=0, and, can suppose λ not losing under the general situation ₁〉=... 〉=λ _n〉=0.The i row of Γ, γ _iIt is ∑ _G ^-1∑ _FEigenvector, corresponding eigenvalue is λ _iUse Γ definition α=(α ₁..., α _n) be α _i=＜X-m, γ _iA vector.Therefore, made up a new random vector α for a random vector Y.

Suppose that X and E have Gaussian Profile, i.e. X～N (m, ∑ _F) and E～N (0, ∑ _G), ∑＞0, and X here and E are independently, can prove in the following method so α～N (0, Λ+I).Significantly, α is that average is 0 normal distribution.In order to verify its covariance, at first observe $\mathrm{\Γ}={\mathrm{\Σ}}_G^{-1/2}\widetilde{\mathrm{\Γ}},$ Here

Be one by ∑ _G ^-1/2∑ _F∑ _G ^-1/2The orthogonal matrix that constitutes of eigenvector.So

VAR(α)＝Γ(∑ _G+∑ _F)Γ

$=\widetilde{\mathrm{\Γ}}*{\mathrm{\Σ}}_G^{-1/2}({\mathrm{\Σ}}_G+{\mathrm{\Σ}}_F){\mathrm{\Σ}}_G^{-1/2}\widetilde{\mathrm{\Γ}}$

$=\widetilde{\mathrm{\Γ}}*\widetilde{\mathrm{\Γ}}+\widetilde{\mathrm{\Γ}}*{\mathrm{\Σ}}_G^{-1/2}\widetilde{\mathrm{\Γ}}$

＝I+Λ

Here final step has been used

Orthogonality and ∑ _G ^-1/2∑ _F∑ _G ^-1/2Eigenvalue and ∑ _G ^-1∑ _F, the fact that equates of eigenvalue.This has proved asserting about the covariance matrix of α.

It is closely similar with principal component transformation in fact that Fisher differentiates conversion.Yet under the situation of coloured noise, promptly the covariance matrix of noise is not under the situation of multiple of unit matrix, and Fisher differentiates conversion can provide remarkable performance.

Be that the second and the 3rd embodiment determines subclass I ₁

Below, suppose that biometric data X has zero-mean (the m this point always can realize by deducting).After using one of them above-mentioned conversion, can obtain a stochastic variable α=Γ _YThe component of α be the center and be incoherent.In addition, under one section the normality assumption, α has a normal distribution, and diagonal covariance matrix is arranged in front.This means component α _i, i=1 ..., n is independently.To use λ _iShow α _iVariance.

Should wander back to, thresholding is to derive from the noise level of the property set that measures, and subclass I ₁Be to create like this: by giving set I ₁Specify the attribute α that created of an absolute value greater than thresholding _iδ is a little positive number, is suitably selected according to noise level.Follow subclass I ₁Constitute by active constituent: I ₁=I _δ(α)=i=1 ..., n:| α _i|＞δ }.Selecting about δ at the robustness of noise is one of most important parameter.In each specific case, should select δ based on the attribute of noise.Noise have normal distribution N (0, σ _N ²Id) under the situation, Id is a unit matrix here, must be according to σ _NSelect δ.For example, for principal component transformation, δ=3 σ _NOr δ=5 σ _NTo can guarantee correctly to discern a bit with 99.87% and 99.99997% probability respectively.

To show that below described conversion will provide the important component of sufficient amount with very big probability.Be expressed as for each i

p _i＝P(|α _i|＞δ)，

$q_i=1-p_i=P\left(\right|{\mathrm{\α}}_i|\≤\mathrm{\δ})=\frac{1}{\sqrt{{2\mathrm{\π\λ}}_1}}{\∫}_{-\mathrm{\δ}}^{\mathrm{\δ}}{e}^{\frac{t^2}{{2\mathrm{\λ}}_1}}\mathrm{dt}.$

Notice following about q _iEstimation have few meaning:

$q_i\≤\sqrt{\frac{2}{{\mathrm{\π\λ}}_1}}\mathrm{\δ}$

Consider stochastic variable $z_i=\left\{\begin{array}{c}0,\left|{\mathrm{\α}}_i\right|\≤\mathrm{\δ},\\ 1,\left|{\mathrm{\α}}_i\right|>\mathrm{\δ}\end{array}\right.$

Notice z _i, i=1 ..., n is independently Bernoulli stochastic variable, wherein P (z _i=1)=p _i, P (z _i=0)=1-p _i=q _i

In order to make that certificate scheme is general, must guarantee a large amount of important component, or in other words and

Must under the condition of very big probability, be sizable.Notice that its desired value is provided by following formula

$E\left(\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{z}_i\right)=\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{p}_i=n-\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{q}_i---\left(0.1\right)$

Very natural can suppose, has a large amount of components, and its variance is greater than c δ ², c＞1.A part of supposing these components is at least ρ.Note, if its variance is much larger than δ ²The quantity of component very little, the whole authentication question that has the physical object of this attribute so will become impossible.Should there be abundant " energy " to distinguish different measured values.If there are not enough abilities in signal, noise will occupy main positions.This will make that the authentication of robust is impossible.

Continue to estimate (1.1), can obtain $E\left(\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{z}_i\right)\≥n-\underset{i=1}{\overset{\mathrm{\ρn}}{\mathrm{\Σ}}}{q}_i-\underset{i=\left[\mathrm{\ρn}\right]+1}{\overset{n}{\mathrm{\Σ}}}{q}_i\≥\left[\mathrm{\ρn}\right](1-\sqrt{\frac{2}{\mathrm{\πc}}})$

Therefore, can draw as drawing a conclusion: if a large amount of big component of variances that has is arranged, so we interested described and desired value will be at least these components quantity most.In other words, can not lose too many component.We estimate the probability of following incident: promptly and ∑ _iz _iLess, just it is much smaller than desired value.In this case, we wish that this incident is impossible, and more properly, its probability diminishes with index.

Make k be less than an integer E (∑ _I=1 ⁿz _i), and consider probability $P(\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{z}_i\≤k)$

The Bernstein index inequality that can the use classics upper limit of deriving.

Make Y ₁..., Y _nBe independent random variable, make | Y _i|≤M, E (Y _i)=0, so for each t＞0,

Can prove $P\left(\right|\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{Y}_i>t\left|\right)\≤2\exp (-\frac{t^2}{{2b}_n^2+\frac{\mathrm{Mt}}{3}}),$ Here $b_n^2={\mathrm{\Σ}}_{i=1}^n{E\left(Y_i\right)}^2.$

Make Y _i=z _i-E (z _i), i=1 ..., n.So | Y _i|≤max (1-p _i, p _i)≤1, and

$E\left({\mathrm{<figure-callout\; id="1"\; label="Y"\; filenames="H04813622219970227E000021.png"\; state="\{\{state\}\}">Y</figure-callout>}}_1^2\right)=E{(z_i-E\left(z_i\right))}^2=\mathrm{var}\left(z_i\right)=p_i(1-p_i)=p_i{q}_i.$

$P(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i\&le;k)=p(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i-E\left(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i\right)\&le;k-E\left(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i\right))=p\left(\right|\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{Y}_i|\&GreaterEqual;|k-E\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i\left|\right).$

Order $E\left({\mathrm{\&Sigma;}}_{i=1}^n{z}_i\right)={\mathrm{\&Sigma;}}_{i=1}^n{p}_i={\mathrm{\&kappa;}}_{1}n,$ And k=k ₂N, and k ₂＜k ₁

So: $P(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i\&le;k)\&le;2\exp \left(\frac{{({\mathrm{\&kappa;}}_1-{\mathrm{\&kappa;}}_2)}^2{n}^2}{2{\mathrm{\&Sigma;}}_i{p}_i{q}_i+2({\mathrm{\&kappa;}}_1-{\mathrm{\&kappa;}}_2)n/3}\right)=2\exp \left(\frac{3{({\mathrm{\&kappa;}}_1-{\mathrm{\&kappa;}}_2)}^2}{6\mathrm{\&tau;}+2({\mathrm{\&kappa;}}_1-{\mathrm{\&kappa;}}_2)}n\right),$

Here $\mathrm{\&tau;}={\mathrm{\&Sigma;}}_{i=1}^n{p}_i{q}_i/n.$

Example: k ₁=0.4n, k ₂=0.2n: $P(\underset{i=1}{\overset{\mathrm{<figure-callout\; id="1"\; label="n\; z"\; filenames="H04813622219970227E000021.png"\; state="\{\{state\}\}">n</figure-callout>}}{\mathrm{\&Sigma;}}}{z}_{}{}_1\&le;0.2n)=\exp (-\frac{3*0.04}{6*0.25+2*0.2}n)\&ap;\exp (-0.063n).$

Example: k ₁=0.4n, k ₂=0.05n:

$P(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{z}_i\&le;0.2n)=\exp \left(\frac{3*0.1225}{6*0.25+2*0.35}n\right)\&ap;\exp (-0.17n).$

Minimizing information

From by the represented robust property set I of α ₁Set out, reduce amount of information by carrying out a kind of reduction conversion.In principle, can use any suitable reduction conversion.Only use the expression of 1 bit can obtain minimum appearing.Advantageously, this can realize by using a kind of like this reduction conversion: the binary digit that the attribute (being component) of α is transformed into the symbol of this deal is represented.

The Heavidide function is a kind of so suitable conversion: $H\left(t\right)=\left\{\begin{array}{c}0,t<0,\\ 1,t\&GreaterEqual;0.\end{array}\right.$

In addition or replacedly, can be by only selecting property set I ₁A subclass come minimizing information.The selection that can be described in the enrollment process to be done by auxiliary data W.Then, this auxiliary data part of being used as verify data is stored and is used when the authentication so that realize selecting same subclass at that time.Preferably, for different application, create different, unique auxiliary data W.By this way, each use to use its oneself subclass (this may be overlapping certainly).

Thereby in a preferred embodiment, use Heaviside function and subclass to select, its target is based on α, i.e. property set I ₁Create the secret C=(C of binary system of certain m bit ₁..., C _m) ∈ 0,1} ^mIf there is different label i ₁..., i _mMake for each j=1 ..., m has i _j∈ I ₁=I _δ(α), and for each j=1 ..., m has

$c_j=H\left({\mathrm{\&alpha;}}_{i_j}\right)=\left\{\begin{array}{c}1,{\mathrm{\&alpha;}}_{i_j}\&GreaterEqual;0\\ 0,{\mathrm{\&alpha;}}_{i_j}<0\end{array}\right.$

So for α, secret C=(C ₁..., C _m) can be considered to feasible.

For α, the set of the secret that all are feasible is expressed as C _δ(α) 0,1} ^m:

C _δ(α)=C ∈ 0,1} ^m: C is feasible for α }

Wish C _δ(α) big as far as possible.Under normality assumption, α _iHas symmetrical distribution.If so s _i=H (α _i), so

$P(s_i=1|\left|{\mathrm{\&alpha;}}_i\right|>\mathrm{\&delta;})=P(s_i=0|\left|{\mathrm{\&alpha;}}_i\right|>\mathrm{\&delta;})=\frac{1}{2}$

In a last trifle, shown that the quantity of the important component of expectation equals the part of n, for example γ n.In addition, having very for desired amt, the probability of big difference will diminish by index.Because for each α _iThe i of＞δ, s _iBe the Bernoulli stochastic variable that is symmetrically distributed, so can expect that the s of half is probably arranged _iBe 1, and the s of half is probably arranged _iBe 0.Use similar index inequality, can prove that any desired value for half has very big departing from, all will become impossible by exponential manner.Therefore, m (secret length) can be chosen as a part of the desired value of important component quantity, i.e. m=γ ₁N, for example γ ₁=γ/10.Can prove that all are 2 years old ^mMost of individual secret is feasible with very big probability for α all.Therefore, for certain physical measurement of an object, can guarantee and from a set greatly, to select a secret with very big probability.So authentication protocol according to the present invention is general on very big probability.On the other hand, in unlikely incident, this incident has only seldom feasible secret for a given biometric information, might use another linear transformation, for example use a kind of W of quadrature at random, for this specific biometric information generates a secret.

Therefore, might select a subclass α _Ij, provide secret C, wherein C _j=H (α _Ij).At this moment just can create auxiliary data W=W (X) by the row of getting Γ, its label is i _j, j=1 ..., k, promptly W is the matrix of a k * n.This auxiliary data is stored as the part of verify data.

Be that first embodiment determines subclass I ₁

In the embodiment of first description, W can be selected as a random matrix.Suppose that measured X is the real vector of n-dimension.In registration phase, select an orthogonal matrix W at random.Make α=WY, select α with the component of enough big absolute value now.In principle, should expect to have a large amount of this equivalents.Using in these equivalents some (but is not whole! ) generate secret C=(c ₁..., c _k), c here _k=H (α _Ik).In other words, $C=H\left(\tilde{W}Y\right),$ Here

Being the matrix of a k * n, is by selecting row I from W ₁... I _kAnd obtain.If W can not cause the big component of sufficient amount, can generate the another one random matrix.

The preferred embodiment general introduction

Registration, example as shown in Fig. 2 A

(1) obtains certain actual corresponding attribute (such as biometrics) X=(X of described object ₁..., X _n) measured value Y=(Y ₁..., Y _n) ∈ R ⁿ

(2) dependency collection Y creates the attribute of robust, provides the set I of the attribute of a robust ₁

Carry out conversion α=Γ Y, Γ classifies to component of a vector according to the signal to noise ratio of estimating here.

Select set I:I ₁=I _δ(α)=| α _i|＞δ }, δ is that noise level from measure is derived here.

(3) minimizing information:

Select I ₁Subclass; Selection has defined choice function W (X), and this W (X) is the subclass of conversion Γ, thereby the subclass of the attribute of selected robust is made of following formula: α _Ij=WY

Generate secret by on this subclass, carrying out reduction: for example, c _j=H (α _Ij) (H is the Heaviside function here) to have provided length be the binary code word C of k≤n.

(4) generate controlling value V, for example by using the one-way hash function hV=h (C) of anticollision

(5) storage: W, V

In a certain embodiments, W is the matrix of a k * n, and C=H (g (Y, W))=H (W (Y-m)), H is the Heaviside function here, m is a vector (for example average) that system is known.This average is done the every group average of measuring, if for example a fingerprint is repeatedly measured, and the fingerprint (promptly all fingerprints being averaged) that this average is exactly on average.

Therefore, whole signal processing function G is provided by G=Hog.In order to ensure the fail safe of verification process, preferably should select W like this so that C=G (Y, component W) is independently, or is incoherent at least, stochastic variable.In order to ensure privacy, C is a binary vector (in a preferred embodiment by the Heaviside function creation), therefore knows that C itself will can not provide one of biometric template good estimation.In addition, select by using by the subclass of W control, can be so that the dimension of C much smaller than the dimension of Y, effectively, be recorded about the most information of Y.In this case, and g (W, Y)=WY, for matrix W multiple attracting selection is arranged.For first embodiment, W may be selected random movement.Be that two preferred embodiments have provided detailed description above, wherein W is respectively a kind of constraint for the principal component transformation (PCT) of specific k-n-dimensional subspace n, and for a kind of constraint of the Fisher conversion of specific k-n-dimensional subspace n.

Authentication is as example among Fig. 2 B

(1) obtains W, Y

(2) obtain certain actual corresponding attribute (such as biometrics) X=(X of described object ₁..., X _n) measurement Y=(Y ₁..., Y _n) ∈ R ⁿ

(3) minimizing information:

Determine the attribute set I of robust ₁: α _Ij=WY

Calculate secret by carrying out reduction: for example, c _j=H (α _Ij) (H is the Heaviside function here) to have provided length be the binary code word C of k≤n.

(4) calculation control value V ' is for example by using one-way hash function the hV '=h (C) of anticollision

(5) if be complementary with the controlling value V that extracts, described object is just certified.

Should be noted that embodiment above-mentioned illustrates rather than limit the present invention, those of skill in the art can design many additional embodiments under the situation of the scope that does not deviate from accessory claim.In the claims, be placed on any reference symbol in the bracket and should be understood as that restriction claim.The element that verb " comprises " and the use of version is not got rid of in claim to be stated or the existence of element the step or step.The article that occurs before an element " a " or " an " do not get rid of and have a plurality of this elements.The present invention can be realized by the hardware mode that comprises several independent elements, and be realized by the computer mode of suitable programming.In the device claim, several modes have been enumerated, several can the realization in these modes by the same project in the hardware.Do not indicate in order not use the combination of these measures for the purpose of favourable in the fact of having stated some measure in the mutually different dependent claims.

Claims (16)

1. a generation is used to authenticate the method for the verify data of a physical object; This method comprises:

Use a kind of measuring process to measure the property set Y of a measurement of described object;

Create the property set I of a robust according to the property set Y of this measurement, the property set I of this robust satisfies a kind of predetermined robust standards;

Create the property set A of a simplification according to the property set I of this robust, the property set A of this simplification comprises still less the information about actual attribute than the property set Y of this measurement;

Generate a protected controlling value V and should protected controlling value insertion verify data according to the attribute of the property set A of this simplification.

2. the described method of claim 1, the step of wherein creating the property set A of this simplification comprise carries out a kind of reduction conversion.

3. the described method of claim 2, wherein said reduction conversion become an attribute transformation binary digit of the symbol of this attribute of expression.

4. the described method of claim 1, the step of wherein creating the property set A of this simplification comprises the subclass of the property set I that selects this robust.

5. the described method of claim 4 comprises that creating auxiliary data W controls the selection of described subclass and this auxiliary data W is inserted verify data being used for.

6. the described method of claim 5 is included as corresponding authentication application and creates unique auxiliary data W.

7. the described method of claim 1, wherein said predetermined robust standards be based on the signal to noise ratio of the attribute that measures, and the step of creating the property set I of this robust is included in property set Y and goes up and carry out the property set I that a kind of conversion Γ creates separation ₁And I ₂, I here ₁The signal to noise ratio of attribute be estimated as and be higher than I ₂The signal to noise ratio of attribute; And use I ₁As property set I.

8. the described method of claim 7, wherein said conversion Γ is a kind of linear transformation, this conversion has a component α with what the vector of representation attribute collection Y converted expression set I to _iA vector, each vector components α here _iWith other component of a vector α _j(i ≠ j) separate and wherein said component of a vector is classified according to the signal to noise ratio of estimating.

9. the described method of claim 7 comprises the step of creating conversion Γ according to the statistical attribute of described measuring process.

10. the described method of claim 9, wherein said statistical attribute comprises the covariance matrix and the corresponding Distribution Statistics F that derive from the attribute X of the estimation of described object.

11. the described method of claim 7 comprises that noise level from the described property set that measures derives a thresholding and its absolute value of being created is assigned to set I greater than the attribute of thresholding ₁

12. the described method of claim 1, the step of wherein creating protected controlling value V are included on the attribute of property set A of this simplification and carry out a kind of encryption function.

13. the described method of claim 12, wherein said encryption function are one-way functions.

14. method that authenticates physical object; This method comprises:

Use a kind of measuring process to measure the property set Y of a measurement of described object;

Create the property set I of a robust according to the property set Y of this measurement, the property set I of this robust satisfies a kind of predetermined robust standards;

Create the property set A of a simplification according to the property set I of this robust, the property set A of this simplification comprises still less the information about actual attribute than the property set Y of this measurement;

Attribute according to the property set A of this simplification generates a protected controlling value V ';

Be extracted in the protected controlling value V that has generated in the enrollment process for described physical object; And

If between the protected controlling value V of protected controlling value V ' that generates and extraction, have a kind of predetermined conforming words, then authenticate physical object.

15. system (100) that is used to authenticate physical object (105); This system comprises a calling mechanism (110), an authenticate device (140) and a memory (130) that is used for storing certification data;

Described calling mechanism (110) comprising:

An input (112) is used to receive the property set Y of the measurement of described object, and the property set Y of this measurement is to use a kind of measuring process to measure;

A processor (114) is used for the property set I according to the property set Y establishment robust of this measurement, and the property set I of this robust satisfies a kind of predetermined robust standards; Create the property set A that simplifies according to the property set I of this robust, the property set A of this simplification comprises still less the information about actual attribute than the property set Y of this measurement; And generate a protected controlling value V according to the attribute of the property set A of this simplification; And

An output (116) is used for supplying protected controlling value V to memory, and this protected controlling value V is used as the part of verify data; And

Described authenticate device (120) comprising:

An input (142) is used to receive the property set Y of the measurement of described object, and the property set Y of this measurement is to use a kind of measuring process to measure, and this input also is used for receiving protected controlling value V from memory;

A processor (144) is used for the property set I according to the property set Y establishment robust of this measurement, and the property set I of this robust satisfies a kind of predetermined robust standards; Be used for creating the property set A that simplifies according to the property set I of this robust, the property set A of this simplification comprises still less the information about actual attribute than this property set Y; Be used for protected controlling value V ' of attribute generation according to the property set A of this simplification; And if between protected controlling value V ' that generates and the protected controlling value V that extracts, have a kind of predetermined consistency, then be used to authenticate physical object; And

An output (146) is used to send one and shows whether authentic signal of described physical object.

16. authenticate device (140) that in the described system of claim 15, uses; This authenticate device comprises:

An input (142) is used to receive the property set Y of the measurement of physical object, and the property set Y of this measurement is to use a kind of measuring process to measure, and this input also is used for receiving protected controlling value V from memory;

A processor (144) is used for the property set I according to the property set Y establishment robust of this measurement, and the property set I of this robust satisfies a kind of predetermined robust standards; Be used for creating the property set A that simplifies according to the property set I of this robust, the property set A of this simplification comprises still less the information about actual attribute than the property set Y of this measurement; Be used for protected controlling value V ' of attribute generation according to the property set A of this simplification; And if between protected controlling value V ' that generates and the protected controlling value V that extracts, have a kind of predetermined consistency, then be used to authenticate physical object; And

An output (146) is used to send whether authentic signal of a described physical object of indication.

Images